CVE-2018-12545: High severity ibm cognos analytics vulnerability
Eclipse Jetty is vulnerable to a denial of service, caused by the additional CPU and memory allocations required to handle changed settings. By sending either large SETTINGs frames container containing many settings, or many small SETTINGs frames, a remote attacker could exploit this vulnerability to cause a denial of service.
Other sources
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12545?
The severity of CVE-2018-12545 is considered high due to its potential to cause denial of service.
How do I fix CVE-2018-12545?
To fix CVE-2018-12545, upgrade to a version of Eclipse Jetty that includes the patch for this vulnerability.
What versions of Eclipse Jetty are affected by CVE-2018-12545?
CVE-2018-12545 affects multiple versions of Eclipse Jetty, including specific releases from 9.3.0 to 9.4.x.
What kind of attacks can exploit CVE-2018-12545?
CVE-2018-12545 can be exploited by sending large or numerous SETTINGs frames, leading to excessive CPU and memory usage.
Is there a workaround for CVE-2018-12545?
There are no confirmed workarounds for CVE-2018-12545; applying the patch is the recommended solution.